diff --git a/services/terraform/.terraform.lock.hcl b/services/terraform/.terraform.lock.hcl
index 7f4cbcbeb..9142a7b83 100644
--- a/services/terraform/.terraform.lock.hcl
+++ b/services/terraform/.terraform.lock.hcl
@@ -1,22 +1,23 @@
 # This file is maintained automatically by "terraform init".
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/hashicorp/aws" {
   version     = "4.9.0"
   constraints = "~> 4.9.0"
   hashes = [
     "h1:OWIIlbMZl/iQ8qR1U7Co3sGjNHL1HJtgNRnnV1kXNuI=",
+    "h1:gx4ni9ZxacUusjZdfLmRVgoMVn1o3CVo0xklOQA2zA8=",
     "zh:084b83aef3335ad4f5e4b8323c6fe43c1ff55e17a7647c6a5cad6af519f72b42",
     "zh:132e47ce69f14de4523b84b213cedf7173398acda14245b1ffe7747aac50f050",
     "zh:2068baef7dfce3613f3b4f27314175e971f8db68d9cde9ec30b5659f80c68c6c",
     "zh:63c6f489683d5f1ac55e82a0df387143ed22701d5f22c109a4d5c9924dd4e437",
     "zh:8115fd21965954fa4568c09331e05bb29da967fab8d077419aed09954378e216",
     "zh:8efdc95fde108f777ed9c79ae25dc17aea9771903250f5c5c8a4c726b90a345f",
     "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
     "zh:9d42a7bc34d84b70c1d1bcc215cabd63abbcbd0352b70bd84da6c3916634932f",
     "zh:aacbcceb241aa475888c0869e87593182edeced3170c76a0c960dd9c905df449",
     "zh:c7fe7904511052e4102870256819a1917177572cf684f0611ebf767f9c1fbaa8",
     "zh:c8e07c3424663d1d0e7e32f4ade8099c19f6326d37c6da98104d90c986ff66fc",
     "zh:e47cafbd38b56ef14fd8d727b4ffea847c166b1c684f585ee5fb78983b537248",
   ]
 }
diff --git a/services/terraform/dynamodb-test.tf b/services/terraform/dynamodb-test.tf
index bde60c1c6..a1b82c0a9 100644
--- a/services/terraform/dynamodb-test.tf
+++ b/services/terraform/dynamodb-test.tf
@@ -1,87 +1,163 @@
 resource "aws_dynamodb_table" "backup-service-backup-test" {
   name           = "backup-service-backup-test"
   hash_key       = "userID"
   range_key      = "backupID"
   write_capacity = 10
   read_capacity  = 10
 
   attribute {
     name = "userID"
     type = "S"
   }
 
   attribute {
     name = "backupID"
     type = "S"
   }
 
   attribute {
     name = "created"
     type = "S"
   }
 
   global_secondary_index {
     name               = "userID-created-index"
     hash_key           = "userID"
     range_key          = "created"
     write_capacity     = 10
     read_capacity      = 10
     projection_type    = "INCLUDE"
     non_key_attributes = ["recoveryData"]
   }
 }
 
 resource "aws_dynamodb_table" "backup-service-log-test" {
   name           = "backup-service-log-test"
   hash_key       = "backupID"
   range_key      = "logID"
   write_capacity = 10
   read_capacity  = 10
 
   attribute {
     name = "backupID"
     type = "S"
   }
 
   attribute {
     name = "logID"
     type = "S"
   }
 }
 
 resource "aws_dynamodb_table" "blob-service-blob-test" {
   name           = "blob-service-blob-test"
   hash_key       = "blobHash"
   write_capacity = 10
   read_capacity  = 10
 
   attribute {
     name = "blobHash"
     type = "S"
   }
 }
 
 resource "aws_dynamodb_table" "blob-service-reverse-index-test" {
   name           = "blob-service-reverse-index-test"
   hash_key       = "holder"
   write_capacity = 10
   read_capacity  = 10
 
   attribute {
     name = "holder"
     type = "S"
   }
 
   attribute {
     name = "blobHash"
     type = "S"
   }
 
   global_secondary_index {
     name               = "blobHash-index"
     hash_key           = "blobHash"
     write_capacity     = 10
     read_capacity      = 10
     projection_type    = "ALL"
   }
 }
+
+resource "aws_dynamodb_table" "tunnelbroker-device-sessions-test" {
+  name           = "tunnelbroker-device-sessions-test"
+  hash_key       = "SessionId"
+  write_capacity = 10
+  read_capacity  = 10
+
+  attribute {
+    name = "SessionId"
+    type = "S"
+  }
+
+  ttl {
+    attribute_name = "Expire"
+    enabled        = true
+  }
+}
+
+resource "aws_dynamodb_table" "tunnelbroker-verification-messages-test" {
+  name           = "tunnelbroker-verification-messages-test"
+  hash_key       = "DeviceId"
+  write_capacity = 10
+  read_capacity  = 10
+
+  attribute {
+    name = "DeviceId"
+    type = "S"
+  }
+
+  ttl {
+    attribute_name = "Expire"
+    enabled        = true
+  }
+}
+
+resource "aws_dynamodb_table" "tunnelbroker-public-keys-test" {
+  name           = "tunnelbroker-public-keys-test"
+  hash_key       = "DeviceId"
+  write_capacity = 10
+  read_capacity  = 10
+
+  attribute {
+    name = "DeviceId"
+    type = "S"
+  }
+}
+
+resource "aws_dynamodb_table" "tunnelbroker-messages-test" {
+  name           = "tunnelbroker-messages-test"
+  hash_key       = "MessageID"
+  write_capacity = 10
+  read_capacity  = 10
+
+  attribute {
+    name = "MessageID"
+    type = "S"
+  }
+
+  attribute {
+    name = "ToDeviceID"
+    type = "S"
+  }
+
+  global_secondary_index {
+    name               = "ToDeviceID-index"
+    hash_key           = "ToDeviceID"
+    write_capacity     = 10
+    read_capacity      = 10
+    projection_type    = "ALL"
+  }
+
+  ttl {
+    attribute_name = "Expire"
+    enabled        = true
+  }
+}
diff --git a/services/terraform/dynamodb.tf b/services/terraform/dynamodb.tf
index f959ee1c2..23ee92535 100644
--- a/services/terraform/dynamodb.tf
+++ b/services/terraform/dynamodb.tf
@@ -1,87 +1,163 @@
 resource "aws_dynamodb_table" "backup-service-backup" {
   name           = "backup-service-backup"
   hash_key       = "userID"
   range_key      = "backupID"
   write_capacity = 10
   read_capacity  = 10
 
   attribute {
     name = "userID"
     type = "S"
   }
 
   attribute {
     name = "backupID"
     type = "S"
   }
 
   attribute {
     name = "created"
     type = "S"
   }
 
   global_secondary_index {
     name               = "userID-created-index"
     hash_key           = "userID"
     range_key          = "created"
     write_capacity     = 10
     read_capacity      = 10
     projection_type    = "INCLUDE"
     non_key_attributes = ["recoveryData"]
   }
 }
 
 resource "aws_dynamodb_table" "backup-service-log" {
   name           = "backup-service-log"
   hash_key       = "backupID"
   range_key      = "logID"
   write_capacity = 10
   read_capacity  = 10
 
   attribute {
     name = "backupID"
     type = "S"
   }
 
   attribute {
     name = "logID"
     type = "S"
   }
 }
 
 resource "aws_dynamodb_table" "blob-service-blob" {
   name           = "blob-service-blob"
   hash_key       = "blobHash"
   write_capacity = 10
   read_capacity  = 10
 
   attribute {
     name = "blobHash"
     type = "S"
   }
 }
 
 resource "aws_dynamodb_table" "blob-service-reverse-index" {
   name           = "blob-service-reverse-index"
   hash_key       = "holder"
   write_capacity = 10
   read_capacity  = 10
 
   attribute {
     name = "holder"
     type = "S"
   }
 
   attribute {
     name = "blobHash"
     type = "S"
   }
 
   global_secondary_index {
     name               = "blobHash-index"
     hash_key           = "blobHash"
     write_capacity     = 10
     read_capacity      = 10
     projection_type    = "ALL"
   }
 }
+
+resource "aws_dynamodb_table" "tunnelbroker-device-sessions" {
+  name           = "tunnelbroker-device-sessions"
+  hash_key       = "SessionId"
+  write_capacity = 10
+  read_capacity  = 10
+
+  attribute {
+    name = "SessionId"
+    type = "S"
+  }
+
+  ttl {
+    attribute_name = "Expire"
+    enabled        = true
+  }
+}
+
+resource "aws_dynamodb_table" "tunnelbroker-verification-messages" {
+  name           = "tunnelbroker-verification-messages"
+  hash_key       = "DeviceId"
+  write_capacity = 10
+  read_capacity  = 10
+
+  attribute {
+    name = "DeviceId"
+    type = "S"
+  }
+
+  ttl {
+    attribute_name = "Expire"
+    enabled        = true
+  }
+}
+
+resource "aws_dynamodb_table" "tunnelbroker-public-keys" {
+  name           = "tunnelbroker-public-keys"
+  hash_key       = "DeviceId"
+  write_capacity = 10
+  read_capacity  = 10
+
+  attribute {
+    name = "DeviceId"
+    type = "S"
+  }
+}
+
+resource "aws_dynamodb_table" "tunnelbroker-messages" {
+  name           = "tunnelbroker-messages"
+  hash_key       = "MessageID"
+  write_capacity = 10
+  read_capacity  = 10
+
+  attribute {
+    name = "MessageID"
+    type = "S"
+  }
+
+  attribute {
+    name = "ToDeviceID"
+    type = "S"
+  }
+
+  global_secondary_index {
+    name               = "ToDeviceID-index"
+    hash_key           = "ToDeviceID"
+    write_capacity     = 10
+    read_capacity      = 10
+    projection_type    = "ALL"
+  }
+
+  ttl {
+    attribute_name = "Expire"
+    enabled        = true
+  }
+}